3 ms·

"Hmm, there are features that one literally can't provide without state (cookies)." Silent cookies aren't completely banned by the GDPR/cookie laws, only cooki

"Hmm, there are features that one literally can't provide without state (cookies)." Silent cookies aren't completely banned by the GDPR/cookie laws, only cookies that aren't necessary to provide the service requested by the user. That's sort of vague, but I think mostly obvious what is intended there. It's pretty easy to operate within the spirit and letter of the law: Shopping baskets, load balancer cookies and login tokens are fine (provided you only use them for those purposes!), third party advertising tracking cookies are absolutely not (without consent). More info here: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/#consent https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... Lawyers have told me that you do not even need consent for Google Analytics, unless you enable the data collection for advertising features. It appears to me that there's intentional bad faith misunderstanding from some, regarding both the cookie law and GDPR, in order to try and paint it as unworkable.

jrochkind1 8y ago
Meanwhile, even though the _only_ user-tracking we do where I work is Google Analytics (no advertising features) (and you say your lawyers say you don't need consent for that) -- the official word on high where I work is all our websites need the stupid "i consent to cookies" banner if we use cookies. So, yeah, it's a mess. These "extra" warnings are contributing to user fatigue, I agree with troy hunt that users are just gonna ignore them all. I also understand why a small organization can say "Well, I don't really understand if we need it or not, the lowest risk thing to do is just to supply it." And there's no law _preventing_ you from supplying an unnecessary pointless cookie warning banner...
- deleted 8y ago
  [deleted]
- FridgeSeal 8y ago
  That’s more the fault of the higher ups for not understanding the law correctly, which really, is on them because the EU went to quite a bit of length to make the document readable and if execs/managers aren’t smart enough to know the difference between necessary and tracking cookies on their own site, then that’s really their own fault.
  - droithomme 8y ago
    > the EU went to quite a bit of length to make the document readable It's 88 pages of legalese consisting of 99 articles distributed over 13 chapters. It also has dozens of footnotes which incorporate thousands of pages of other laws by reference. > and if execs/managers aren’t smart enough Clearly I am too stupid to operate a business and have reading comprehension problems. Thanks for letting me know.
- flukus 8y ago
  > Meanwhile, even though the _only_ user-tracking we do where I work is Google Analytics (no advertising features) (and you say your lawyers say you don't need consent for that) -- the official word on high where I work is all our websites need the stupid "i consent to cookies" banner if we use cookies. Google analytics feeds tracking data to google for advertising purposes and tracks you across sites, it's exactly the sort of crap the cookie warning was meant to stop. > These "extra" warnings are contributing to user fatigue Your need for analytics is contributing to user fatigue. > I agree with troy hunt that users are just gonna ignore them all So do websites putting up these silly warnings, do you actually wait for people to accept before they get their tracking cookie?
  - lmkg 8y ago
    > Google analytics feeds tracking data to google for advertising purposes and tracks you across sites That is why GP said "(no advertising features)." That is the name of the feature in GA that does that, and it can be disabled.
    - Grumbledour 8y ago
      However, google is still a third party and I would argue this is not legal, as is using google maps or other external entities known to employ excessive tracking unless you have special data protection contracts with said entity. But I also understand the law, that anonymous user statistics are just fine and don't need consent as long as you retain the data yourself and of course mention it in your privacy policy. Though you might still be obligated to respect "do not track" and adding an opt-out setting.
tripzilch 8y ago
> It appears to me that there's intentional bad faith misunderstanding from some, regarding both the cookie law and GDPR, in order to try and paint it as unworkable. Very much this. None of the cookie warning dialogs (I've seen) mention this, and a lot of them use the dialog to complain about the law. Something seems to have changed when GDPR came around though. The cookie warning dialogs before just had angry or condescending warnings with only a big "I accept" button, and otherwise too bad. But recently I've begun to see more and more warning dialogs that both have more honest wording about what they're about, as well as providing a "Decline" button. IIRC there is something in the GDPR about explaining the privacy choices in clear language to the user, as well as having to provide an alternative if possible. If that's the case then it really does smell like intentional bad faith. Although to be fair in addition to bad faith, I think it's also a lot of webdevelopers just not doing research what is exactly required and just parroting the scary story off each other. But there's certainly a large part that just want to scare their users into accepting Google Analytics tracking. I'm curious about what those lawyers told you, though. Analytics data flowing through a third party widget that is doing the same on almost every site anywhere, sure feels like tracking to me. But maybe if you disable the data collection for advertising option, Google really won't cross-correlate that data for their own purposes. Even then, doesn't Analytics track the path users take on a single site too? For measuring "conversions" and such, as well as just detect whether people get "lost" on the site, or something. Now certainly that's useful information, but it is tracking. Also you can get a lot of that information (and more) by just doing basic usability testing on real users. No tracking required and if you ask 10 people to try your site, you get 90% of the usability issues, with diminishing returns (based on some usability research I once read somewhere). But the information is much higher quality because you can ask them questions, ask them to perform tasks, actually look over their shoulder, etc. Tracking website users through analytics is just numbers and doesn't tell the whole story in very many cases, anyway.
- bmn__ 8y ago
  > if you ask 10 people to try your site, you get 90% of the usability issues, with diminishing returns (based on some usability research I once read somewhere) https://www.nngroup.com/articles/why-you-only-need-to-test-with-5-users/ https://www.nngroup.com/articles/why-you-only-need-to-test-w...

jrochkind1 8y ago

Meanwhile, even though the _only_ user-tracking we do where I work is Google Analytics (no advertising features) (and you say your lawyers say you don't need consent for that) -- the official word on high where I work is all our websites need the stupid "i consent to cookies" banner if we use cookies. So, yeah, it's a mess. These "extra" warnings are contributing to user fatigue, I agree with troy hunt that users are just gonna ignore them all. I also understand why a small organization can say "Well, I don't really understand if we need it or not, the lowest risk thing to do is just to supply it." And there's no law _preventing_ you from supplying an unnecessary pointless cookie warning banner...

deleted 8y ago
[deleted]
FridgeSeal 8y ago
That’s more the fault of the higher ups for not understanding the law correctly, which really, is on them because the EU went to quite a bit of length to make the document readable and if execs/managers aren’t smart enough to know the difference between necessary and tracking cookies on their own site, then that’s really their own fault.
- droithomme 8y ago
  > the EU went to quite a bit of length to make the document readable It's 88 pages of legalese consisting of 99 articles distributed over 13 chapters. It also has dozens of footnotes which incorporate thousands of pages of other laws by reference. > and if execs/managers aren’t smart enough Clearly I am too stupid to operate a business and have reading comprehension problems. Thanks for letting me know.
flukus 8y ago
> Meanwhile, even though the _only_ user-tracking we do where I work is Google Analytics (no advertising features) (and you say your lawyers say you don't need consent for that) -- the official word on high where I work is all our websites need the stupid "i consent to cookies" banner if we use cookies. Google analytics feeds tracking data to google for advertising purposes and tracks you across sites, it's exactly the sort of crap the cookie warning was meant to stop. > These "extra" warnings are contributing to user fatigue Your need for analytics is contributing to user fatigue. > I agree with troy hunt that users are just gonna ignore them all So do websites putting up these silly warnings, do you actually wait for people to accept before they get their tracking cookie?
- lmkg 8y ago
  > Google analytics feeds tracking data to google for advertising purposes and tracks you across sites That is why GP said "(no advertising features)." That is the name of the feature in GA that does that, and it can be disabled.
  - Grumbledour 8y ago
    However, google is still a third party and I would argue this is not legal, as is using google maps or other external entities known to employ excessive tracking unless you have special data protection contracts with said entity. But I also understand the law, that anonymous user statistics are just fine and don't need consent as long as you retain the data yourself and of course mention it in your privacy policy. Though you might still be obligated to respect "do not track" and adding an opt-out setting.

tripzilch 8y ago

> It appears to me that there's intentional bad faith misunderstanding from some, regarding both the cookie law and GDPR, in order to try and paint it as unworkable. Very much this. None of the cookie warning dialogs (I've seen) mention this, and a lot of them use the dialog to complain about the law. Something seems to have changed when GDPR came around though. The cookie warning dialogs before just had angry or condescending warnings with only a big "I accept" button, and otherwise too bad. But recently I've begun to see more and more warning dialogs that both have more honest wording about what they're about, as well as providing a "Decline" button. IIRC there is something in the GDPR about explaining the privacy choices in clear language to the user, as well as having to provide an alternative if possible. If that's the case then it really does smell like intentional bad faith. Although to be fair in addition to bad faith, I think it's also a lot of webdevelopers just not doing research what is exactly required and just parroting the scary story off each other. But there's certainly a large part that just want to scare their users into accepting Google Analytics tracking. I'm curious about what those lawyers told you, though. Analytics data flowing through a third party widget that is doing the same on almost every site anywhere, sure feels like tracking to me. But maybe if you disable the data collection for advertising option, Google really won't cross-correlate that data for their own purposes. Even then, doesn't Analytics track the path users take on a single site too? For measuring "conversions" and such, as well as just detect whether people get "lost" on the site, or something. Now certainly that's useful information, but it is tracking. Also you can get a lot of that information (and more) by just doing basic usability testing on real users. No tracking required and if you ask 10 people to try your site, you get 90% of the usability issues, with diminishing returns (based on some usability research I once read somewhere). But the information is much higher quality because you can ask them questions, ask them to perform tasks, actually look over their shoulder, etc. Tracking website users through analytics is just numbers and doesn't tell the whole story in very many cases, anyway.

bmn__ 8y ago
> if you ask 10 people to try your site, you get 90% of the usability issues, with diminishing returns (based on some usability research I once read somewhere) https://www.nngroup.com/articles/why-you-only-need-to-test-with-5-users/ https://www.nngroup.com/articles/why-you-only-need-to-test-w...